Skip to content
Tovari Docs

Log in with email + password

POST
/auth/login
curl --request POST \
  --url https://api.tovarifinancial.com/auth/login \
  --header 'Content-Type: application/json' \
  --data '{ "email": "hello@example.com", "password": "example" }'

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
email
required
string format: email
password
required
string
Examplegenerated
{
  "email": "hello@example.com",
  "password": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Authenticated (tokens issued), OR a second factor is required (challenge returned, no tokens)

Media typeapplication/json
object
data
required
One of:

Authenticated session — tokens issued.

object
accessToken
required
string
idToken
required
string
refreshToken
required
string
expiresIn
required

Access/ID token lifetime in seconds.

integer
user
required
object
id
required
string format: uuid
email
required
string
name
required
string
nullable
orgId
required
string format: uuid
orgRole
required
string
debugConsoleEnabled
required
boolean
onboardingCompleted
required
boolean
outstandingPolicies
required
Array<object>
object
id
required
string format: uuid
policyType
required
string
version
required
integer
title
required
string
firstAcceptance
required

TRUE when the outstanding policies are a first acceptance rather than an update.

boolean
verification
required
object
status
required

Derived from users.email_verified, the sole source of truth for the gate.

string
Allowed values: verified unverified
codeDeliveryDetails
object
destination
required
string
deliveryMedium
required
string
cooldownSeconds

Seconds the resend button stays disabled after an interactive send.

integer
sendsRemaining
integer
language
required

The session user display-language state (KAN-3773).

object
spanishEnabled
required

The per-environment Spanish rollout flag. False ⇒ effectiveLocale is always ‘en’.

boolean
preference
required

The explicit choice; null = use device language.

string
nullable
Allowed values: en es
detected
required

This request’s X-Client-Locale, else the last-seen device language, else null.

string
nullable
Allowed values: en es
effectiveLocale
required

The language to display: ‘en’ when the flag is off, else preference ?? detected ?? ‘en’.

string
Allowed values: en es
message
string
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "data": {
    "verification": {
      "status": "verified"
    },
    "language": {
      "preference": "en",
      "detected": "en",
      "effectiveLocale": "en"
    }
  }
}

400

Section titled “400”

Validation failed — see errorCode / fieldErrors

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

401

Section titled “401”

Missing, invalid, or expired bearer token

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

500

Section titled “500”

Internal error (no internal detail leaked)

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}

503

Section titled “503”

Service temporarily unavailable — errorCode is SERVICE_UNAVAILABLE. A TRANSIENT, RETRYABLE condition rather than a defect in the request: a query that exceeded its time budget, a lost or refused database connection, a saturated connection pool, or an outage at an upstream provider the request depends on (the authentication provider, or the bank data provider on a bank-connection operation). The identical request may succeed on retry — back off briefly and, on a write, resend the same X-Idempotency-Key where the operation accepts one.

Media typeapplication/json
object
errorCode
required

Machine-readable error code (AUTH_ERROR_CODES).

string
Allowed values: INVALID_EMAIL_FORMAT USER_ALREADY_EXISTS INVALID_INVITE_CODE WRONG_PASSWORD USER_NOT_FOUND AUTHENTICATION_FAILED EXPIRED_CODE INVALID_CODE INVALID_PASSWORD VALIDATION_ERROR SIGNUP_FAILED DATABASE_ERROR SERVICE_UNAVAILABLE PLAID_ERROR IDEMPOTENCY_CONFLICT ACCOUNT_ALREADY_LINKED NOT_FOUND
message
required
string
fieldErrors

Optional field-level validation errors, keyed by field name.

object
key
additional properties
Array<string>
requestId
required
string
timestamp
required
string format: date-time
Example
{
  "errorCode": "INVALID_EMAIL_FORMAT"
}